Skip to content

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51124

Open
sguilhen wants to merge 3 commits into
keycloak:mainfrom
sguilhen:50785-apacheds-am27-upgrade
Open

Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563#51124
sguilhen wants to merge 3 commits into
keycloak:mainfrom
sguilhen:50785-apacheds-am27-upgrade

Conversation

@sguilhen

@sguilhen sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Closes #50785

@sguilhen
sguilhen requested review from a team as code owners July 23, 2026 19:35
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 53419f2 to f0f0bf3 Compare July 23, 2026 19:55
@sguilhen

sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Notes about the changes needed to bump Apache DS to 2.0.0.AM27:

  • bumped apacheds.version to 2.0.0.AM27 and apacheds.codec.version to 2.1.8
  • added Apache Kerby dependencies where necessary (kerb-simplekdc, kerb-client). AM27 removed apacheds-protocol-kerberos; KDC is now provided by Kerby.
  • rewrote embedded KDC from ApacheDS KdcServer to Kerby KdcServer.
  • rewrote KerberosKeytabCreator, moving from ApacheDS KerberosKeyFactory to Kerby EncryptionHandler. The old API was removed in AM27. Explicit enc type list matches what KeyDerivationInterceptor derives.
  • disabled requestCredDeleg (credential delegation) in KeycloakSPNegoSchemeFactory. Kerby KDC doesn't echo the FORWARDED flag in TGS-REP, causing JDK's KrbKdcRep.check() to reject with error 41. (DIRKRB-458).
  • skipped AbsctractKerberosSingleRealmTest.credentialDelegationTestwithAssume.assumeTruebecause Kerby doesn't support theFORWARDED` ticket flag.

Aside from that, there's a minor architectural change between the versions: in AM26, the ApacheDS KDC accessed the DirectoryService in-process (via kdcServer.setDirectoryService()). In AM27 (Kerby), this is no longer possible, and the KDC connects to LDAP over the network via LdapIdentityBackend.

@sguilhen

sguilhen commented Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Also worth mentioning: I've had to add krb5AccountDisabled, krb5AccountLockedOut, krb5AccountExpirationTime, and krb5KDCFlags attributes to all krb5kdcentry entries in the kerberos test LDIF files. Kerby's LdapIdentityGetHelper NPEs without them as it calls .getString() on nullable LDAP attributes with no null check.

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 23, 2026
Closed
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 23, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 23, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.broker.KcOidcBrokerTest#loginWithExistingUserWithBruteForceEnabled

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
Expected condition failed: waiting for value to contain (ignoring case) "sign in to". Current value: "AUTH_RESPONSE" (tried for 5 second(s) with 500 milliseconds interval)
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: org.jboss.arquillian.drone.webdriver.htmlunit.DroneHtmlUnitDriver_ByGraphene
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#testLoginPageRefresh

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

@sguilhen
sguilhen requested review from Copilot and mposolda July 24, 2026 13:14
Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Upgrades ApacheDS and LDAP API dependencies to address CVE-2026-35563 while migrating embedded Kerberos support to Apache Kerby.

Changes:

  • Upgrades ApacheDS to AM27 and LDAP API to 2.1.8.
  • Replaces removed ApacheDS KDC/keytab APIs with Kerby.
  • Updates Kerberos fixtures and delegation behavior.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
pom.xml Updates and aligns ApacheDS/LDAP API versions.
util/embedded-ldap/pom.xml Adds Kerby dependencies.
util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java Migrates keytab generation to Kerby.
util/embedded-ldap/src/main/resources/kerberos/default-users.ldif Adds Kerby-required account attributes.
util/embedded-ldap/src/main/resources/kerberos/default-users-kc2.ldif Adds attributes for the secondary realm.
testsuite/utils/pom.xml Adds Kerby test utilities.
testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java Replaces ApacheDS KDC with Kerby LDAP-backed KDC.
testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos.ldif Updates primary-realm test identities.
testsuite/integration-arquillian/tests/base/src/test/resources/kerberos/users-kerberos-kc2.ldif Updates secondary-realm test identities.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/KeycloakSPNegoSchemeFactory.java Makes credential delegation configurable.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosTest.java Disables delegation for embedded Kerby.
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java Changes delegation-test eligibility.

Comment thread testsuite/utils/src/main/java/org/keycloak/testsuite/KerberosEmbeddedServer.java Outdated
Comment thread ...rc/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java
Comment on lines +180 to +181
Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
!getKerberosRule().isStartEmbeddedLdapServer());

@sguilhen sguilhen Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

True observation but this condition is pre-existing. The invokeLdap method was never designed for external providers. When the internal MSAD pipeline runs the credential delegation test, it would need the LDAP URL/DN adapted. But this isn't something we introduced, it was already the case before our change.

@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 24, 2026
Open
keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

Copilot AI review requested due to automatic review settings July 24, 2026 21:22
Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/federation/kerberos/AbstractKerberosSingleRealmTest.java:181

  • This now skips credentialDelegationTest under every checked-in Kerberos configuration: the connection files either set idm.test.ldap.start.embedded.ldap.server=true or rely on its true default. Credential delegation therefore loses all automated coverage; please add a runnable external-KDC configuration/job (or another fixture) instead of leaving this test permanently skipped.
        Assume.assumeTrue("Credential delegation not supported with embedded Kerby KDC",
                !getKerberosRule().isStartEmbeddedLdapServer());

sguilhen added 3 commits July 24, 2026 18:51
@sguilhen
Upgrade ApacheDS to 2.0.0.AM27 to address CVE-2026-35563
edb85b0 
Closes keycloak#50785

Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
Enable credential delegation test against external KDCs
01998b8 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
@sguilhen
Fix KDC ticket lifetime values for Kerby (seconds, not milliseconds)
c1cd6b9 
Signed-off-by: Stefan Guilhen <sguilhen@redhat.com>
Copilot AI review requested due to automatic review settings July 24, 2026 22:10
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from f207204 to 82cfd60 Compare July 24, 2026 22:10
@keycloak-github-bot keycloak-github-bot Bot mentioned this pull request Jul 24, 2026
Open
@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.forms.MultipleTabsLoginTest#multipleTabsParallelLoginTestWithAuthSessionExpiredAndRegisterClick

Keycloak CI - Forms IT (firefox)

org.opentest4j.AssertionFailedError: expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java
for (EncryptionType encType : KEYTAB_ENC_TYPES) {
EncryptionKey key = EncryptionHandler.string2Key(principalName, passPhrase, encType);
System.out.println("Adding keytab entry of type: " + encType.getName());
entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));
Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/LDAPEmbeddedServer.java Outdated
Comment on lines +247 to +249
Hashtable<String, String> env = new Hashtable<>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://" + this.bindHost + ":" + this.bindPort);
Copilot AI review requested due to automatic review settings July 24, 2026 22:21
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 82cfd60 to 5e8ea7d Compare July 24, 2026 22:21
Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

  • EncryptionHandler.string2Key returns a key with Kerby's default KVNO of -1; passing that through writes 0xff (KVNO 255) into the keytab instead of the previous implementation's KVNO 0. This can prevent the generated keytab from matching service tickets, so pass an explicit KVNO (0 preserves the old behavior).
                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 24, 2026
View reviewed changes
Comment thread util/embedded-ldap/src/main/java/org/keycloak/util/ldap/LDAPEmbeddedServer.java Fixed
Copilot AI review requested due to automatic review settings July 24, 2026 23:14
@sguilhen
sguilhen force-pushed the 50785-apacheds-am27-upgrade branch from 5e8ea7d to c1cd6b9 Compare July 24, 2026 23:14
@keycloak-github-bot

keycloak-github-bot Bot commented Jul 24, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 24, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Copilot AI reviewed Jul 24, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

util/embedded-ldap/src/main/java/org/keycloak/util/ldap/KerberosKeytabCreator.java:98

  • EncryptionHandler.string2Key initializes EncryptionKey with kvno -1, so passing key.getKvno() makes Kerby's keytab writer serialize version 255. The previous implementation produced kvno 0 (the wildcard version); keep that value explicitly so generated keytabs can match the versioned tickets issued by the LDAP-backed KDC.
                entries.add(new KeytabEntry(principal, timeStamp, key.getKvno(), key));

@keycloak-github-bot

keycloak-github-bot Bot commented Jul 25, 2026

Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 17)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '17.0.19'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserCredentialVaultAuthenticationSimpleEncryptionStartTLS

Keycloak CI - Java Distribution IT (windows-latest - temurin - 21)

java.lang.RuntimeException: org.apache.http.NoHttpResponseException: localhost:8543 failed to respond
	at org.keycloak.testsuite.util.oauth.AbstractHttpPostRequest.send(AbstractHttpPostRequest.java:89)
	at org.keycloak.testsuite.util.oauth.AbstractOAuthClient.doAccessTokenRequest(AbstractOAuthClient.java:134)
	at org.keycloak.testsuite.AbstractTestRealmKeycloakTest.sendTokenRequestAndGetResponse(AbstractTestRealmKeycloakTest.java:126)
	at org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest.verifyLoginSucceededAndLogout(LDAPUserLoginTest.java:153)
...

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Windows Server 2025', os.arch: 'amd64', os.version: '10.0', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

org.keycloak.testsuite.federation.ldap.LDAPUserLoginTest#loginLDAPUserAuthenticationNoneEncryptionStartTLS

Keycloak CI - Java Distribution IT (ubuntu-latest - temurin - 21)

org.openqa.selenium.TimeoutException: 
java.net.SocketTimeoutException: Read timed out
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1020-azure', java.version: '21.0.11'
Driver info: driver.version: HtmlUnitDriver
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed Jul 25, 2026
View reviewed changes

@keycloak-github-bot keycloak-github-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@mposolda mposolda Awaiting requested review from mposolda
+2 more reviewers
@github-advanced-security github-advanced-security[bot] github-advanced-security[bot] left review comments
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

flaky-test team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname

3 participants

@sguilhen @github-advanced-security